CVE-2026-25496

MEDIUM

Craft CMS 4.0.0-4.16.17 and 5.0.0-RC1-5.8.21 - Stored Cross-Site Scripting in Number Field Prefix and Suffix Settings

Title source: llm
STIX 2.1

Description

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a stored XSS vulnerability exists in the Number field type settings. The Prefix and Suffix fields are rendered using the |md|raw Twig filter without proper escaping, allowing script execution when the Number field is displayed on users' profiles. This issue is patched in versions 4.16.18 and 5.8.22.

Scores

CVSS v3 4.8
EPSS 0.0036
EPSS Percentile 27.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (4)
craftcms/cms 5.0.0-RC1 - 5.8.22Packagist
craftcms/craft_cms 4.0.0 (4 CPE variants)
craftcms/craft_cms 5.0.0 (2 CPE variants)
craftcms/craft_cms 4.0.0 - 4.16.18
Published Feb 09, 2026
Tracked Since Feb 18, 2026